Bug 703468

Summary:	CVE-2011-1720: Memory corruption in Postfix SMTP server Cyrus SASL support [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Jan ONDREJ <ondrejj>
Component:	postfix	Assignee:	Jaroslav Škarvada <jskarvad>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	14	CC:	jskarvad, mlichvar
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.postfix.org/CVE-2011-1720.html
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-05-10 13:44:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Jan ONDREJ 2011-05-10 12:51:02 UTC

Description of problem:
The Postfix SMTP server has a memory corruption error when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN (the ANONYMOUS mechanism is unaffected but should not be enabled for different reasons). See below for instructions to determine what systems are affected.

Examples of affected Cyrus SASL authentication methods are CRAM-MD5, DIGEST-MD5, EXTERNAL, GSSAPI, KERBEROS_V4, NTLM, OTP, PASSDSS-3DES-1, and SRP.

The error was introduced with the Postfix SASL patch, and is present in all Postfix versions where the command "postconf mail_release_date" reports a value of 20000314 (March 14, 2000) or greater.

This problem was discovered by Thomas Jarosch of Intra2net AG.

The memory corruption is known to result in a program crash (SIGSEV). Remote code execution cannot be excluded. Such code would execute as the unprivileged "postfix" user. This user has no control over processes that run with non-postfix privileges including Postfix processes running as root; the impact may be reduced with configurations that enable the Postfix chroot feature or that use platform-dependent privilege-reducing features.

The problem is fixed in Postfix stable releases 2.5.13, 2.6.10, 2.7.4, 2.8.3; in the Postfix 2.9 development release as of May 1, 2011; patches exist for Postfix version 1.1 and later. All this is available from Postfix mirror sites listed at http://www.postfix.org/download.html.

Version-Release number of selected component (if applicable):
postfix-2.7.3-1.fc14.i686

How reproducible:
not tested

Additional information:
http://www.postfix.org/CVE-2011-1720.html

Comment 1 Jaroslav Škarvada 2011-05-10 13:44:32 UTC

It is already in Bodhi, please give it positive karma, F14 version:
https://admin.fedoraproject.org/updates/postfix-2.7.4-1.fc14